Unspoken Security Ep 43: Evolution of Detection Engineering

we can give you the information by going out and mapping threat actors, setting up their infrastructure, so you don't have to be the patient zero, right? That is, you know, crazy impactful and obviously gives us a lot of joy, right, in terms of what we do. And that's, you know, that's why we work, right? We do it because we want to have impact and enjoy what we're doing. So there's probably other things that we could have done that would have been easier to make money from, right?

Welcome to Unspoken Security, the raw and gritty podcast a podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. Been building and maturing intelligence programs in the private sector for about 9+ years now, I guess. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go zags. So I continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not going to be the typical polished podcast. My dogs, both of them actually at this point, occasionally have made appearances on the show. Today they're both at daycare. Don't worry, we should be quiet. People argue and debate here. We even swear sometimes. I certainly do. That's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today I'm joined by Ken Bagnall. He's founder and CEO of SilentPush, a preemptive cyber intelligence platform that exposes threat actor infrastructure as it's being set up using indicators of future attack. Ken has an extensive track record of defending companies from cyber attacks. He was the founder of The Email Laundry, which was acquired by FireEye in 2017. Where Ken then served as Vice President of Product Management. He's a cybersecurity investment company as well called The Phish Security that funds innovation in the sector. And he sits on the advisory board of StrikeReady, a security operations platform. As if that's not enough, Ken previously was on the board of Information Security Ireland, the Executive Council of CompTIA UK, and the Executive Council of the EU Protective Threat Intelligence Project. I can't imagine what more you'd be doing with your time, Ken. Is there something you want to add to that profile or did we capture everything?

Now, I think that that's the critical stuff for this conversation, for sure. Brilliant.

All right. I appreciate you coming on today and making time, Ken. You know, we had a chance to do some prep, obviously, in advance, and I appreciate that you've had a chance to come back and talk with me today. So I want to jump right into the topic. Today's topic is the evolution of detection engineering, which I'm going to be honest with you, detection engineering, it has never really been a big strength of mine. I've learned over the years, I'm an Intel guy, so I've, you know, I've had to learn more about it. But it's been very technical and sometimes a little bit dry. But in talking with you, I found it really interesting what you're working on. So I'm excited to have this conversation. I didn't think I was going to be, if I'm gonna be truthful, about the topic, but I think this is actually really interesting. So before we jump into the evolution of detection engineering, we better start with a little bit of the history so people know we're all on the same page here. So can you talk a bit about the history of detection engineering? Like, how long have you been doing this? What have you seen?

Yeah, so I guess, you know, Some of this conversation is in honor of my co-founder, John Jensen, who's been working with me for over 20 years, right? I came into the picture during the email security phase where, you know, we were evolving really how people thought about what was, what seems a very rudimentary problem now, right? In hindsight with unwanted email, whatever type it was, right? Whether it was spam or whether it had malicious attachments or whatever. But there was huge volumes of it. And, you know, I think the majority of people were kind of doing content type inspection, which was heavy in the processing. And also it's, it's far riskier in terms of getting false positives, et cetera, right? On determining what was good or bad or wanted or unwanted. Because the definition of what was unwanted is, is kind of in the head of the recipient really. And that, that kind of leaves you as someone providing the service subject to the, the whimsical nature of, to, of what they considered to be something that mattered or not.

Mm-hmm.

So we made a point of completely switching our focus to, you know, where it was coming from and determining the quality of the connecting server, right? That's, that's sending. The, the email. And as we kind of went heavy down that road, we discovered we were able to actually stop 97% of the stuff without ever receiving it in the first place, you know, with nobody ever contacting us to look for any of those emails that we were blocking at the connection, just not, not accepting the connection in the first place even, right? And, and I think that's, that's a affected everything that we've done since, you know, every, every, I think, product that we stepped into since, we've always tried to push as far back towards the threat actor as possible, and we continue to do that to this day, right? But I think that's, that's kind of a key factor, you know, you can, you can waste an awful lot of resources in the wrong place and trying to make the wrong decisions while there's something more fundamental to be done. And I think across security, you can kind of take that as a little bit of a mantra and always try and push back. There's, you know, people waste efforts on things that really don't matter, right? And suck up loads of resources. And I think that kind of email security scenario is just a pure example of you know, where if you're actually focused on the core issue, you won't even have to deal with the majority of the issue in the first place.

Yeah, I mean, that's a good point. I think people focus a lot of times on things, like you said, that may not be the things they need to focus on, either because it's the shiny object, you know, the newsworthy, sexy thing, or, you know, I've seen, I've been involved in, frankly, projects where people have asked for stuff that's very interesting, but not really useful. If I'm being fully honest, and as an Intel guy, that happens, especially when I first moved into the private sector, you know, out of the government space, because Intel is still, is still a growing field in the private sector, but it really was in its nascent, you know, beginnings when I joined the private sector. And people would want, you know, I want this deep profile on somebody and you can go out and do this. I can give you, yeah, on some threat actors we can go all the way down to here's their home address, here's their phone number, here's what their, you know, social media looks like. Here's pictures of them. Here's all this stuff. And they love it and they get excited and then they show it to their leadership and they go, wow, look what we can do. None of that made us any safer. That was, that was days of effort. So that, you know, and I, and I figured that out and sometimes it was fine cuz it helped with, you know, perceptions of our capabilities or it helped with funding or whatever it might've been. Right. But we were show ponies a lot of times as well cuz people just wanted the gee whiz moment of, man, we got these spooks we got from the government and they could do all sorts of things. And it's a waste of time and effort. Yeah. Not to say that understanding adversaries is a waste of time and effort. And, and I think what you're talking about makes a lot of sense. You know, as an intel guy, I do often say the only thing that's proactive is intelligence. By definition, everything else is reactive. And everybody wants to be proactive. Everybody wants to do something before they're impacted, right? But then they don't really want to invest in intel. So I think what you're talking about leans into that, right? The ability to, to get further outside of our own environment and, and closer to the adversaries and, and really be to their infrastructure.

I mean, you're talking about a perfect example actually of this in, in, in real life. I actually, I won't even say the company we were in at the time, but so let's say, you know, we progressed and we're doing this for large organizations later on. And someone from a different department whose, you know, cares were different to ours came up to us to complain that we were now blocking all email tests from customers. We're going, that's correct. That's, that's the job, right? Nice. Yeah. And they're saying, but we need to see it. And we're going, I don't care.

Yeah. Those are some competing objectives right there, I would say.

Yeah.

My job is just to stop it altogether.

Right.

Well, we want to see it. Well, that's your problem. Like, we'll, we'll give you some samples. What are you asking for? So what do you have to do in that case though? Did you create like a neutral zone or you're capturing things that you can put off to the side for them then instead of just straight blocking it?

Yeah. No, you could choose, you know, you could use it if it hit something that was not customer traffic, you know, where we had kind of honeypots up, you know, taking in traffic or something, then they, then they, then they can have it, but not through customer traffic, right? Which is what they're asking.

Right. Yeah, that's not going to happen. Yeah, it's, I mean, you're doing a job too well is what you're saying at that point. So, you know, that's a good problem to have. I think most people would be thrilled. You know, I mean, you mentioned that you'd reach 97% of unwanted mail. Was never even receiving, you know, never even getting to the clients. And this is obviously, you know, in previous work you've done, frankly.

Yeah, never, never even getting to content inspection, right? So moving on from that kind of point, you know, later on we were seeing, you know, across different types of detection products that, you know, everything, even in the thought process to how people were detecting things, was always based on somebody getting infected first.

Yep.

You know, someone has to be patient zero and, you know, we're not happy with that outcome, right?

Yeah.

Particularly if you can launch, you know, a load of patient zeros at the same time, people on different vendors has to be, you know, has to hit each vendor and stuff before it's even been looked at to be called protection rules for other people. So it's just all too slow, problematic. And then when it's going into places and people are deciding, you know, what rules to make to put back out to detect it, it's such a slow and laborious process that it's allowing more people to be affected, right? To, to be that patient zero. So that's something that we absolutely hated as well, right? Because we'd already got our kind of high and mighty mindset about how we do things as a team, right?

Well, you set a pretty high bar, right? Once you, once you've, you've said, hey, we're gonna block things in advance. We're gonna be the company that, or, or the innovators. 'Cause I know that that was actually a different company still at the time, I think. But we're gonna be the kind of innovators that, that stop things before they happen as opposed to, to reacting, which is how most of the intel or most of the security community still works is on reaction, right? Like I said, I talk a lot about being, you know, more proactive, left of boom we talk about. Yes. And where that's intel, most things just aren't. That's just how it works. Most things, like you said, you have to wait till something happens, you get an indicator, You get in event, even, you know, if somebody says, well, we, you know, we saw something in our environment, we hunted it, we found it, we stopped it. And that's great. I mean, nothing happened, but they were already in your environment, right? People sometimes, you know, miss that point of you didn't actually stop them from getting in. You stopped them from doing harm, which is good. It'd be better if they never got in the door. You know, it's, it's the difference between did somebody get into my house and hang out in my living room for a while and then I found them and kicked them out before they stole anything or broke anything. Or did they just never get to my house? You know, they, maybe they didn't even find my house, which would be even better, right? And we've all just sort of accepted that it's okay for people to get into the house and walk around a little bit as long as we kick 'em out before they take anything or break anything.

Exactly.

Nobody would, nobody would accept that in our personal lives. You know, if I came home and people were just hanging around in my house, we'd have some problems around here. So, so it's good to hear, you know, when you talk about being a company who doesn't want to be that way. It says, hey, I want to get further ahead and, and keep people from getting there. So. With that in mind, like, what do you see as the biggest or most interesting challenges today, you know, as you're working to continue to give people the opportunity to be ahead of the curve on these things?

Yeah, so obviously we wanted to be like a neutral provider to everybody. So regardless of what your security stack is, that, you know, we can give you the information by going out and mapping threat actors, setting up their infrastructure. So you don't have to be the patient zero, right? And that, that is, you know, crazy impactful and obviously gives us a lot of joy, right? In, in terms of what we do. And that's, you know, that's why we work, right? We do it because we want to have impact and enjoy what we're doing. So there's probably other things that we could have done that would have been easier to make money from, right? But this is, this is, this is the thing we love doing. But what we see now is capabilities on the other end to throw up so much free infrastructure. There's so many things available to them to, you know, continually use free. So like the, the impact on the threat actor is tiny to keep spinning up more and more, right? That they're throwing up just huge volumes of stuff. So I think that is something that everybody's going to struggle with more and more. I know You know, people are using more and more different ways of automated setting up of these things, right? We'll use the term AI just because we have to, right? But—

Right. Sure.

You know, in terms of having complex automations in place and being able to set up, you know, an endless small, you know, small iterations of different companies, et cetera, plus their web infrastructure, like we'd see with FIN7 or someone, right?

Mm-hmm.

You know, you can see a huge number of these kind of fake company pages that they have. Have on any given day. It's the volume from which someone can attack you from is like pretty bizarre, I think, now compared to a while ago. And that has to be having, you know, a pretty big impact on who they're hitting because it's really hard to stop and it's always fresh infrastructure. So the patient zero thing almost doesn't apply anymore because you could be patient zero all day, right? It just keeps coming. It's just constant new stuff. So I think that's a big thing to contend with, and it's a difficult thing to contend with. And some of it we're going to have to deal with in the process, right? So I don't know if you saw, you probably wouldn't have noticed this, but the US Treasury put in sanctions against a company operating out of the Philippines last month, which is a— we use the term infrastructure laundering, right? So It's like a malicious CDN provider that will sit on top of Microsoft Azure and Amazon and stuff, right? So you're using the CDN to move across different providers. So it's not the same as a, as kind of a fast flux network, but they're also making a point of moving it between Chinese and US infrastructure. So they want like non-collaborating hosting providers, right? Make it even harder to take down. So the Treasury, you know, thankfully put in sanctions against them. So now we've got a little bit more to go on to force people to stop accepting, you know, hosting for this particular malicious CDN. But it's, it's part of like one of the biggest crime groups in the world, right? That provide the infrastructure for pig butchering. And there's a whole range of crimes, right? Including money laundering and stuff. But I think because they have such scale, like crazy scale, they have 1.4 million live hostnames a day, right? Performing, you know, for all sorts of scams. Or you can also, there's affiliate programs in Europe and Africa and stuff, right? All throwing out this stuff constantly. And without us like really going after them with process as well, it's hard to have an impact, right? Because the old-fashioned way people did things were they'd do an abuse report per page or something, right?

Sure. Millions of those won't do us a lot of good.

Ah, it's irrelevant, right? It's completely laughable. Or, you know, that's what a lot of providers would ask you, you know, oh, please, you know, just contact our abuse report for that exact page.

Right.

I don't, I don't think we can do that. Like, we can see all 1.4 million at the same time. Why don't we just like take them all down at the same time, right? Instead of like going through a process for each one. It's ridiculous. And it's also not feasible from our point of view, right? So, but that's, that's part of the game, I think, on their end, right? Is to try and put the effort back to the person reporting it and not, not have to deal with the large takedown.

Yeah, exactly. Well, and you make a good point, right? With With every technology, right, it's— things get cheaper over time, right? So it used to be IOCs, and I say used to be as if people aren't using them anymore. A lot of people still are, obviously, but it used to be that's the way it went, was we all went with IOCs. Hey, it's, you know, we're gonna block all the traffic from this domain name, or block all the traffic from this IP, you know, we're going to look for these signatures, etc. But people can shuffle through domain names and IPs, addresses, just at will now. It's very, very inexpensive. I just said $1.4 million. So, you know, large scale operations are cheap, frankly. You know, you don't have to be a nation state, you don't have to have, you know, millions in financial backing from a, from a large criminal enterprise to set something like that up. Now they're all very, very inexpensive. And then you mentioned Funnel Technology, I think is the company you're talking about out of the Philippines. Obviously there's a lot of that going around too. And, and we've had issues for years with bulletproof hosting overseas and things like that where you can't get takedowns., you know, accomplish and other issues with it. But the infrastructure is just so cheap, right? So it's so easy to put together. We can't continue to do the IOC thing and expect that to work because it's just going to be an endless— we talk about whack-a-mole, but now you're talking about it at millions. It just, it's non-stop, right? They can burn all the IP addresses they want to just get more of them. It's— they can burn cell phone numbers the same way, you know, virtual phone numbers. So if you talk about, you know, getting into like smishing, or we're getting out to more of the AI-enabled you know, impersonations, etc. Phone number— don't— I sadly, I do the same thing. I get junk calls all the time and I block numbers. I have no idea how many phone numbers I actually have blocked on my phone. I'm sure it's—

I find that we've all just stopped using our phone for phone calls. It's like, for the most part, like you never get real phone calls anymore, you know.

It's pretty rare. And I'm frustrated, I'm sure you are as well, you know. In our industry, most people I know work internationally, so I can't just decide I'm not going to take calls from a specific area. Oh, I'm not going to use that area code anymore, it's all junk. Well, it's not all junk. I can get a random call at 3 in the morning from someplace and I can't just ignore it. It might actually be real. So I'm forced to figure out a solution for that. Like you said, a lot of times I just don't answer the call. I'm just like, ah, they'll, they'll text me if they, if they wanna talk to me, they'll hit me on Signal or something. And if I do pick it up, it's normally a very quick, oh, okay, it's fake, block and move on. And I've got an endless supply of those. It's not really making life easier, I don't think, because you block that number, but 2 weeks later they're not using that number anyway. They're right back with another one and another one and another one. You know, pig butchering scams are constantly coming at people on the phone.

Yeah.

And text messaging as well. So the infrastructure anyway is, as you said, inexpensive. So they're, they're able to continue to build more, which means just IOCs and trying to block and tackle isn't really gonna be the solution, which is, I, I assume, I mean, I'm pretty sure you're, you're the one talking about getting away from that. So, you know, it's, it's interesting to see how that's working. How does this, we didn't talk about this in prep by the way, so this will be a kind of a curveball, but How does something like this relate to, you know, I know companies out there that do like deception, right? Where they, they will let an actor think they've gotten into an environment, but they haven't really gotten into the corporate environment, and then you can watch their behavior, et cetera. Do you dabble in the deception space as well, or is it really more about just understanding the adversary architecture to keep things from coming towards a customer?

Yeah, we did. We don't really dabble in deception other than, you know, we do a lot of inbound packet inspection on inbound scanning. So we've got large honeynet projects for that. So that's, you know, on the mildest end of deception, pretend to be certain types of infrastructure and see what the conversation is. But yeah, we don't really go into deception ourselves in terms of letting them in any further than a, than a honeypot.

Yeah, that makes sense. It might be, I, I know anybody who's building intel organizations or security organizations, it's almost always a few vendors you wanna work with anyway. So if somebody's working with deception, it's good to know maybe they can be a partner with you. It's, it's not really an overlap. It sounds like it'd be more of a complementary relationship if they want to let people get into some areas so they can, you know, analyze it differently. Obviously the honeypotting you're doing, I'm sure pulls a lot of really good information, so maybe they don't need the extra piece. You know, I know some organizations—

Yeah, like the most important thing we do, like we're pretty aggressive data collectors. So for us, like the key to our view of the internet is change detection.

Mm-hmm.

So we're, we re-resolve all DNS records every day. And we're really making change information, right? The rate of change of domains across IP space, et cetera. And then we're constantly scanning for changes on what the header responses are, et cetera, which is, you know, kind of phase 2 for us, I guess. We always look at DNS changes first before we look at the infrastructure that's stood up, et cetera, because we can see a lot of people's automation on DNS changes. So that's where we kind of make most of our, rules, you know.

How, how much scale are we talking about when you say this? I mean, I mean, the internet's obviously vast, and I don't know, I, you can reveal how many clients you're working with, etc.

But everything in terms of DNS, so everything, and then all the subdomains that we discover, we'll scan them as hostnames. So it's not just IP scanning, it's all everything that we discover. And then we do a lot of work that we don't talk about as much on residential proxies and stuff. So that's, that's pretty important work for us as well, because, you know, a lot of crime is coming through your TV, right?

Or your— right, exactly. Internet of Things is, is maybe not the smartest thing we've ever come up with as a— I mean, I'm guilty. I got a smart house. I got a whole bunch of stuff here too, because it's convenient. And that's— people will give up a lot of security for convenience.

So a couple of things we want to do, you know, kind of strategically is try and push threat actors to bulletproof hosting. Because it's easier for an enterprise to defend from kind of known bad parts of the internet than from, you know, all residences, right?

Right, exactly.

Or, or, you know, the other option which we were trying to deal with there before with Funnel was, you know, mainstream hosting providers. You don't, you don't mix up with the genuine enterprise traffic, right? That's, that's the main thing. Uh, if you can, if you can push people in different directions, then at least they have a chance of, of defending themselves. So we put a, we put a lot of effort into, into kind of those thought processes and making sure we try and push the bad guys into known bulletproof hosting.

Uh, yeah. Now that's really interesting. So I know, again, I'm gonna ask you some curveballs here, 'cause you know, I only prep a little bit for the show, as you know, and then we go as, as the conversation comes along. I know one of the things you guys offer as a company is you do brand protection as well, right? That's one of the services you offer. And I know having been in that space, one of the challenges I've run into— so I'm, I'm leading to a question, I promise. One of the challenges I've run into in that space is when customers have come to us and said, hey, you know, somebody's impersonating our, our brand. We want you to take down this site. And you can't 'cause it's Bulletproof hosted. And we, you know, you have that back and forth discussion, try to explain, you know, where limitations are. We can put in the request, but there's only so much you can do if it's Bulletproof hosting, other country, et cetera, et cetera. At the same time, you're actually trying to drive more adversaries to Bulletproof hosting, which makes sense because from a, a traffic standpoint, Again, it's not everybody. Now we're getting back to a place where IOCs actually matter. We know Bulletproof Hosting is just, we're gonna block all that. How does that work out for you? Do you end up with conflicts occasionally when you're dealing with the brand protection versus, you know, the other services you offer? Do customers, are there challenges with that? Is there a way to, to try to steer just the right traffic and the right adversaries back to Bulletproof Hosting so you're blocking them but not have the brand protection components go there?

Yeah, no, I think, I think, I think you've gotta drive them to Bulletproof Hosting and don't think about the brand protection in that way because the people to be defended from the brand impersonation, you know, they can still defend themselves by just not having Bulletproof hosting providers as part of their traffic, right? So really we gotta defend the enterprise from the obvious choice. So pushing into Bulletproof hosting, even if it is impersonating your brand, it's less bad if it's sitting in an obvious bulletproof hosting provider than sitting on Azure, right? It's a vastly different thing to deal with because at least you know that other enterprises can safely, you know, put away that traffic without fear of false positives, which is always the giant fear for Intel, isn't it? You know, we accidentally blocked whatever, right? So get everything on—

No, it's popular when we do that.

At least if you can segregate infrastructure, as usable or, you know, definitely defendable. That's a nice clean line. Hard one to actually make happen, you know, where we're talking about it as if that actually is an easy one. The other thing we do get is, you know, Bulletproof hosting providers offering to work with us, right? Oh. And that happens a lot more than you'd expect. So, you know, they wanna kind of have you on some sort of a reasonably friendly term to them. And yeah, I don't know if you've seen, you know, those, those reports, I think with Comrie and us. Mm-hmm. And you know, that's, that's a thing for sure. Yeah.

And that's a relatively new thing, I think. Correct me if I'm wrong, at least I know historically Bulletproof Hosters have not been easy to work with. Right. It's, that's kind of been the thing. I, at least from my experience, I shouldn't say historically as if that's everyone's experience, but I know my experience from an Intel standpoint, especially if it's been involved in brand protection, is it often ends up being this brick wall where it's like, hey, we're not—

I don't think they're— I don't think they're easy to work with. I think they're trying to play a very specific game, you know.

Yeah.

Where— well, I mean, they're money motivated, right? They're, they're, they're— it's a criminal enterprise, money motivated. So money—

yeah, we'll give you some—

they'll make all sorts of deals with other people if it, if it'll benefit them. What's that?

They, they're like, we'll give you some stuff if you stay off our backs.

Yeah, yeah, yeah. There's always a negotiation. Criminals are some of the better negotiators in the world, in my opinion, whether it's physical crime, whether it's cybercrime, whatever it is. I mean, it, there's an opportunism to it. There's a practical, you know, they, they're very practical, generally speaking. That's a rational type of a thing of, you know, I'll scratch your back, you scratch mine. There's not a lot of loyalties generally. The whole thing about, you know, no honor among thieves, but there's still a code in there as well. So it, you know, I have seen some ability to work with cybercriminals. Certainly we've seen a lot of that in, say, ransomware over the last few years, how professionalized that's become. Where now they have customer service that goes, oh, oh, you don't know how to get Bitcoin? No, we'll help you with that. Don't worry, we'll help you set up a wallet. And they're very friendly in helping you get back the data that they've locked you off from and try to make the pain go away that they've created, right? So, you know, I think we've seen a lot of professionalization in, in crime, and this is, I guess, another example is that they're, they're being more malleable and more reasonable to work with because, like you said, they want, they want some advantage out of it. So that probably puts you in a pretty good position compared to a lot of your clients who I'm sure don't know how to work directly with, you know, with these, these, these Bulletproof hosting groups and other places for that.

Yeah, we, we would obviously also have kind of some strange relationships with, you know, residential proxy providers and stuff as well, because, you know, while we want to be able to identify these things, we also want to be able to see the view from strange places. So, you know, we do like to pop out in unusual places to scan stuff from, you know, wherever, because that, that, that can matter to us as well. But there's a lot of aspects, I guess, about what we do that, you know, require a lot of thought.

Well, that's, I mean, that's good. I, I think, you know, it's, I, I think if you're gonna have a viable business, it has to be something that's hard to an extent, or anybody would do it, right? Now, you know, you wanna be able to provide something that people don't have and, and don't have the capability to do or the knowledge. And you apparently have both the capability and the knowledge to do a lot of things people can't do. So giving that some thought, so you've been, Silent Push has been around about 5 years now. How do you see detection engineering evolving over the next few years? And, and I'm gonna ask the question everybody's gonna ask anyway. Let's also talk about that in terms of AI. Where does that fit in? But, but in general, how do you see detection engineering evolving over the next few years?

Yeah, so I, I, I think we're in a state of enormous flux and there's like huge opportunities popping up for criminals at a rate that that probably hasn't been before. But I think we've said that, you know, every 10 years, right? Because of something else, right? The, you know, cloud services, right? They, they, they didn't exist at one point, right?

Right.

So I think, I think we will just have to watch the same things that we always had to watch to see, because there's actually quite a lag between technologies coming out and it becoming popular among cybercriminals. And some things can sit there for a while with just a minority of people using them or APT groups using them. And it's a, it's, it, it, it can be a long time or maybe some of them don't ever pop out into like the larger cybercriminal community, which is when it like scales to like the embarrassing size problems, which I would think of like the funnel situation, right? As like, you know, we, we shouldn't be looking at that. That should have been dealt with, right? Uh, where it's so big, so obvious, it's like a hole in the internet, right? It's, it's ridiculous.

Wow.

So I think, I think at the minute we've gotta watch things really carefully because I, I've kind of held this for, for your last question as well, but one of the tricks that we do that is, let's say our unspoken thing, right? Is we watch marketing people. Because all bad behavior starts with marketing people.

Oh man. I just heard all the marketing people shut off the show today. I'm hearing it right now, even though this is recorded, obviously I can't, but yeah, I'm sure a whole bunch of people are cringing. So go ahead and explain all bad things start with marketing. I'm listening.

So in terms of the initial thoughts of abuse, right?

Mm-hmm.

The, the seeds will, I think, initially be sown in a marketing meeting somewhere. Someone goes, you know, why can't we use that for, you know, X? And, you know, it just means to, you know, massively publicize whatever it is we want to publicize. And, and, you know, so many things have stemmed out of that thought process. Obviously beginning with spam, right? Where I think we started that conversation in the first place. You know, it's a lovely idea that we all have like an open technology that we can send each other a message on. Oh, why don't we use that too? Right? Yeah.

Why don't we abuse that and send people thousands and thousands of things they never asked for?

Right? Yeah. And then if you, if you follow through, you know, all of the technical opportunities that have popped up since then. And you can imagine the meeting where it happened, where someone said, oh, why don't we use that too? And then, you know, spread whatever, whatever item we want. So we, and we see, see this constantly, like, so have you seen, I presume you've seen Open Redirects?

Sure.

That's, that's like one of the things I'm just still scratching my head at, right? You see stuff sent, you know, through a marketing platform as the bank, you know, And it's just, how is this still happening?

Like, it's, yeah, it's pretty risky. Yeah. I get some fun stuff occasionally when I realize, oh, you've been compromised because this is not the way this should have come to me. And I just had one the other day. I had to look back like, why am I getting this? And I figured it out.

It's often a feature of the marketing platform. It is. Frank is using or something, right? And Jesus, this is, this is nuts, right? So, so we're going to see just an incredible proliferation of things because of AI products, uh, you know, and in a way I'm looking forward to it.

Well, it's good for your business, I guess. I, I'm not going to pretend I'm looking forward to it.

I'm, I'm seeing some of it, but there's something a little sick in all of us, isn't there?

Well, that's true. That's, that's true. I mean, I have had occasions where things have happened and people are horrified and I'm just like, oh, that's really You gotta give 'em credit. And they're like, what do you mean give 'em credit? I'm like, listen, I, I like smart criminals. Like I've always said that I, I get frustrated at somebody who does something stupid, not something bad. I mean, evil's a different thing, right? But in terms of like criminal behavior, I don't like dumb criminals. It's insulting. Like I get bad phishing emails or bad, you know, pig butchering efforts. I'm insulted more than anything. I'm like, seriously, you looked at my profile and you still thought this would work on me? I'm really insulted. I like well-crafted ones. I mean, I still, I still will respond to them and clown them a little bit. But I, I, I respect good crime. You know, I respect somebody who's, who's made the effort. They're on the wrong side, you know, for where we live, but I, I like it at least. So I'm with you on that. There's something exciting about it. And, and AI is showing a lot of that. You know, I, I know, you know, you mentioned a lot of technologies don't really get, you know, big uptake. And that's true, or at least they take time. AI, I would say, has been very much, in my opinion, the exception to that in just how rapidly everybody, including criminals, has taken, you know, taken advantage of it, right? Phishing emails got exponentially better almost overnight. It felt like anybody can write a phishing email now. We don't have the old emails. We can look and go, well, this is clearly somebody whose English is their second or third or fourth language. None of it makes any sense and you can throw it away. And now these are perfectly crafted emails and now you can actually, you know, the impersonation of a brand to go with, it's easier than having to go get one and copy and paste. And like, don't worry, the AI will give it to you now. And so, and now we're getting into, you know, the voice impersonation. We're getting into the, the, You know, video. I'm, I'm actually working on some, you know, video, AI-generated video as well, so I, I can kind of demonstrate how creepy it can be. So I mean, on that aspect, it's remarkably well adopted, I think, by adversaries. And then what you're talking about, going back to the previous piece about the volume, I mean, you can use AI tools to help them register new URLs, new domains, all this automation. I mean, it's not true AI, it's automation, but again, they're able to do that very rapidly. As you said, millions of of, you know, URLs that are being registered, you know, constantly. That's not done manually. Nobody's going through and manually picking out, you know, registering URL names and signing up with, you know, providers at 99 cents a year or whatever the number is, right? It's all automation. So, you know, the technologies really, you know, pick up the scale. And then we end up in that arms race where, all right, we're all trying to figure out the technologies on the defender side as fast as they are on the, the adversary side. And the adversaries generally go pretty fast on these things.

Ah, yeah. So do you, you've made an interesting point on the, on the language thing, right? So the use of AI for language. So a number of countries have now suddenly seen just a huge spike in cybercrime and phishing emails that didn't have it before because they were quite awkward to, you know, even to culturally be able to get the correct thing together. And now you can, you can really do it, you know, with AI. So I think Japan is one that has. You know, really been hit hard by cybercriminals in the last 2 years and growing every day, right? Because there are so many layers to trying to perform cybercrime against Japanese. Not just the language in the email, but the subtle undertones. And, you know, there's a lot to it. And it's, you know, it's dealt with very well with AI. So suddenly, they have everybody having a pop at them who's been very practiced at doing it, you know, in the English language or whatever, right? And now they're turning their skills against places with other languages and other alphabets in particular, which I think was a factor that was holding people back.

Sure. I mean, that's a really interesting point. And you say it and I go, well, of course. And yet I hadn't really thought of it before now because you're right. Most, you know, most of the efforts have been against English speaking and, you know, and, you know, some French and, and, you know, Russian and, and a couple other large languages, right? But it's been limited for the most part because I mean worldwide English is spoken more than any other language, I believe, you know, in terms of number of countries, right? And so that's where a lot of people, people have been targeting and that's also where there are a lot of, there's a lot of money. Nobody was gonna take the time and effort to figure out how to target, you know, Japanese or Thai or I, I think a lot of Asian languages come up cuz again, the alphabets are very different and the cultures are very different. The communication structure's different. You know, the Middle East has some of that too. You know, Arabic is, is not an easy language and it's structured differently. AI just bridges all that gap. You know, you made a great point. So you're gonna have threat actors who've been doing this, who are professional criminals for decades, who've got all of their structures lined up, all of their organization. They've had their trial and error. They know what tricks people and what doesn't, and they can apply all that knowledge to a group, a nation of potential future victims who have very little knowledge in defending against this cuz they're not seeing it every day. I mean, we see, I can't even count how many junk emails I get per day and junk you know, SMS and, you know, LinkedIn messages and all these things. And it's not as much part of the culture in some of these countries. So you're making a really interesting point in that how AI is going to change that. I'll be looking forward to seeing, and I hadn't, but I will now, the stats over the next, you know, 6 months, year, 2 years, when we see annually, you know, number of cyberattacks, you know, amount of, you know, financial losses in cybercrime. I don't think it'll become, you know, flat by any means across countries, but I bet we're going to see a big jump from countries who traditionally haven't had big numbers in those spaces because now adversaries can attack them without having to learn their language and their culture. Just the AI will bridge the gap and it'll be clumsy at first, but it gets pretty good. Language models, I mean, that is what it does. So that's a really interesting point. Uh, are you seeing that yet? Are you preparing for that?

No, no, we're seeing that for sure.

Yeah.

So we've been traveling around Asia a lot and yeah, this is, this is a big deal at the moment. So, and in Japan in particular, it's a, it's a huge issue because it's also, you know, a, a wealthy country, right? But I mean, I think generally if you're traveling around Asia at the minute, you'll kind of realize it's, it's kind of the first world at the minute, right? Like, it's, it's pretty impressive growth across the entire region. But yeah, these guys are seeing a lot of stuff for the first time and starting to hit the subtleties that are required to fill them. But a lot of it's still pretty easy for us to pick up at scale, right? So it's— some of it's not as complex in terms of the background infrastructure and stuff they're using to target them. So it's pretty identifiable in our ways. So, you know, it's handy to hand it all over to them. But they're coming up with like just endless amounts of scams compared to what they had before. I think it's a lot of, it's a lot of scam stuff, you know.

Uh-huh. Uh-huh.

But it's, it's, it's not just, even Singapore, like, which is, you know, can be done in English as well. Philippines are getting hit with a lot of stuff. Yeah, it's, it's, it's kind of across Asia for sure. Korea gets hit all the time anyway. South Korea, but they'd, they'd be more practiced because, you know, they had their own interested party doing this.

Exactly. Yeah.

Yeah.

They had a bit more to work about over the last few years because again, one of the few nation states that primarily does cyber for crime purposes instead of for— Yes. Yeah. And instead of for national security purposes or for, you know, espionage or something like that. North Korea is notorious for being a, you know, as much a criminal enterprise as it is a government. So yeah, the South Koreans have, are well aware of the threats of cybercrime coming from a large, you know, organization that's well-versed and knows their language and culture very well. So yeah, I, I think theirs is slightly different as you mentioned, but it is interesting to hear and it makes, again, it makes sense when you say it, how much growth we're gonna see in Asia in this space. And, and the other, I, I imagine we may see some, this is going out on a limb, but Swahili is the, is the official language of business through all of Africa. As of, I don't know, like 10 years ago, I think, actually. Swahili's not a language that's spoken by a lot of people outside of Africa. But if it's the official language of business for the continent, I would reckon that there are going to be adversaries who, again, using AI, can transition things over. And now they've got something that they can go Swahili, which is throughout all of Africa. Africa's growing. It is not certainly first world economics like Asia or, or, you know, the United States or much of Europe, but there's a lot of growth to be had there. And there are some countries that have a lot of money and, and are looking at that.

Yeah.

There's been, there's been quite an increase in terms of, so, you know, you used to have, the affiliate programs operating out of Africa charge targeting, you know, United States and other, other kind of Western countries, right? Which is, it's kind of a risk of exporting your culture is that, you know, it's easier for people to target you, right? Because they know your day-to-day stuff, right? But there's been a large increase there for sure in targeting Africans for sure. And then we saw before Christmas there, there was like, was it Operation Serengeti? So it was like 1,000 arrests. And I think the majority of that was kind of affiliate schemes of the Triad Nexus crowd, right, in Southeast Asia, you know, that was operating through the funnel network. So they also operate, so they operate full crime as a service. So you, you know, you can get the full stack, including the money laundering at the end, right? So they, they, They were highly active and you can get all localized infrastructure. So, you know, we've seen them for like the Japanese stock exchange, French stock exchange, you know, we've seen impersonations in all languages with support provided in those languages, et cetera, to the victim. You know, pretty huge operations, but definitely you've seen them Africans targeting Africa more.

Well, that's interesting too. I mean, obviously it was always Africans targeting the West, right? And that's where the money is. So being able to turn it back inward because there's more money and more opportunity as things are growing there. And again, it's going to be a less trained, you know, group of potential victims, right? They're not, they're not as hardened as, as people have been dealing with this for so long. And that's not to say the West is doing a great job. Most everybody I know has been compromised at some point still. So as, as much as we know, We still make a lot of mistakes because again, there's this volume, right? It's just constantly coming at you. I don't care how good you are at this. We've all been hit at least once, myself included. Caught an email wrong, you know, perfect timing, perfect theme on my phone. Almost always if I'm gonna get hit, it's something on my phone, so I don't have a chance to go look at headers and pay attention. I'm in a hurry and you click a thing, then you go, well, I've made a mistake. Thankfully it's not pig butchering and I'm not out a bunch of money, but it happens to everybody, you know, because they have so much volume, which is why we need companies who can help keep us from having these things. Like you said, the less things that get to the end, that get to the user, the better. I can't make a mistake if it doesn't get to me. And the only way for it not to get to me is if somebody already knows in advance where it might be coming from and can protect me. And that's too hard to do on our own. So it's good to have others out there that are looking to do that. I, I'm curious, uh, uh, one last bit before we start wrapping this up. You know, I had mentioned asking about what do you think's gonna happen the next few years? So what do you think about active defense? You know, I know there's been discussions about that becoming a more prominent thing? I remember going back as far as 10 years, there were discussions and the government debated it, certainly in the US, you know, what is active defense? You know, are you, are you allowed to be operational? Are you allowed to be offensive? From a government standpoint, there's laws and, and regulations, and then what can the private sector do? But what are you seeing in the future in terms of active defense?

Yeah, so there's all, there's already quite a ground shift on this, I think. I think the Japanese have already announced that they will be doing more active defense. So I've also seen movement from a couple of other Asian countries, right, in terms of them making sure they have capabilities in this regard. So I think, I think people will be knocking on the door of threat actors for sure, and they'll be trying to mess with other people's operations that are targeting them directly. No doubt about it. There's also like, you know, I mean, there's, there's, there's generally kind of a wave of nationalism going globally, which affects how people think about these things as well. So you see some kind of large efforts to, you know, put national firewalls in place more, you know, it used to be a select few countries would have some sort of national firewall, right? Seems to be more of a thing now, right? It's, it's broader scope. I would say it is acceptable now where it wasn't, you know, you see people, European Union, right? All about privacy, but also about European DNS protection there, right?

Right. These all seem to go together.

But, you know, so I think there's some strange changes afoot about how people think about these things. And a lot of it is driven by, you know, a change in mindset about keeping ours for us and other people out, right? So these things are linked. You know, the, the thought process towards active defense and towards, you know, having national firewalls are actually, they're part of the same thought process, if you follow me. It's, it's, it's definitely, I think we're, we're at the end of this kind of what I've been calling the age of piracy, right? You know, it's the equivalent of back in, in, in, in the early days of colonialism where people were sending out pirates, right? And the British Empire were sending out people to steal the Spanish gold from their ships, right? And you could get a license to do it, right?

Right.

And I think cybercrime has been like that for a while now. So, you know, if you were stealing from a non-collaborative country, no problem. It was okay where you are, right? So, you know, go take forth, bring money back to us, right? Spread it around. Everybody, everybody's going to be okay with that. And, you know, I think that is, that is a big problem, right? Because a number of countries have actually started to add up the hole in the bucket, right? That there's money leaking out of and gone, hold on a second, this is ridiculous, right? You know, it's the equivalent of if, as if we've lost one of our main industries and they have it. Like, that's how much it costs to them, right? So it's, it is a point of national security to actually deal with these things on a national level. Only some countries have copped onto it and done it right. Others, others haven't. So the, the hole in the bucket is still there. Uh, so I think that's, that's a, that's a big change, but it's, it's a reason why people are thinking of active defense as well, right? It's, it's not just, you know, physical security, kind of defense security. It's like, hold on a second, we have to protect our economy. If someone's gonna be just draining this place, we have to, we have to do something about it.

Well, and that's an interesting shift. You know, you mentioned, I, I, and this is something I've been following now for, you know, well over 10 years back when I was in the government space. There's no international norms, right? We, there've been discussions and, and there've been different small groups that have come up with small, you know, plans and treaties and ideas. But, and that was back again when I was in the government, but now 10, 11 years later, we still don't have an agreement. So when we talk about something like active defense, you know, the risk had always been you might start a war, you might have an international incident. What qualifies an active war, right? What is, what is active defense versus what is offensive operations and where's that line going to be? And there's no real definitions for a lot of these things, which means you could be in a situation where somebody says, well, we're doing something proactively, but it's in our own defense and this is the reason why. And either, you know, the other side just disagrees whether it's true or not. They'll deny that they had malicious intent, which we've seen a lot of. Or it turns out, what if you're wrong and you've made a mistake, right? And so they're actually saying, no, we're a victim now. You, you accused us of something we didn't do and took action as a result. And you know, whether you did it on purpose or as an accident. And so I, I worry about that and how we're gonna find that. I see the shift and I think you're right in that people have said, hey, we just can't keep going the way we're going. Frustration, if nothing else, might lead somebody to say, let's try something different. But it's gonna come up with a whole new set of risks and problems here, especially if it's ungoverned., right? There's no international law that says what's, what's in and out, out of bounds. Certainly there aren't per nation either. So how are you gonna decide what's it okay for the bank to decide to go defend themselves doing, or for a retailer to decide is okay to do versus what is an offensive cyber operation? Have you done, have you now started an international incident or created a war between, you know, our country and another country because you, you've done something, you know, offensive, right? So I, I'm worried about what that might look like in the future.

I'm not sure what you have to do to start a war from offensive at the minute, because I think most things have been done without a war, you know. So there's, there's definitely a question there as to what, as to what it's going to be before it counts, because people have taken down hospitals and stuff, right?

And a lot of people— no, you're right, it's, it's been sort of the boiling frog thing where we all thought we knew what it would be. Well, the red lines should be like they are in kinetic world, but they're not, clearly. And we've seen, we've seen power System, you know, we've seen power grids taken down, we've seen hospitals taken down, we've seen, you know, economic structures, you know, delayed and major things. Like if it was done in a kinetic way, it would clearly be an act of war. These are things against, you know, infrastructure of, of company, of, of countries. And we don't, right? We just react and fix it and kind of go on. I, I think nobody wants to yet, which is good. You know, I don't think anybody wants to start firing missiles in response to a cyber attack, but I do think there's gonna be a point. I don't know what it is. I can't pretend I know what the line is that defines it either. But we're gonna have one at some point, and I fear that it's gonna be something that's done by a civilian organization who's taking on active defense as opposed to a nation state who intended to, you know, somebody's gonna get there. Yeah. Especially because listen, we have a lot of talent leaving the government, going to the private sector, which is a good thing. But that means people, you know, like myself, although more talented, show up with a different mentality too, and some different knowledge and different capabilities and may look at it differently. And if they've, they've been in the government space, they've been in the intelligence community, they've been in the military. And they, they bring in that sort of thought process, they may be able to do a lot of harm in ways that the private sector couldn't before 'cause they didn't have the talent, let alone the, the desire. And now you're gonna put both those things together and then the government might be left holding the bag to try to go, wait a minute, don't, don't, don't attack us. This, this shouldn't have happened. So I, I fear we're gonna have to figure this out internationally pretty fast. Get something that resembles treaties or agreements or some sort of memorandum of understanding.

Yeah.

It could head for chaos for sure. And then we could also have mistakes, right? Just like certain amateurs gone wrong. You'll have the Morris worm, you know?

Yeah, I mean, we're gonna have mistakes. There's no way around it. Whenever you give really dangerous, powerful technology to the masses, you're gonna have that happen, right? You know, and we're seeing that with, you know, again, how inexpensive it is for the architecture, you know, and the infrastructure to create these things. How accessible and inexpensive and powerful AI is, for instance. You know, this is the ability to do some really significant to harm, significant cybercrime on a low budget with little knowledge is right there, right? It's, you know, in the kinetic world, it'd be like handing every one of us a nuclear bomb and then, you know, hoping nobody does anything wrong with it. Somebody's probably going to make a mistake at some point. So it's interesting to see where that's going to go. But I, I think you've given us some good stuff to think about there in terms certainly of Asia, you know, is one that I would take away from this and say, well, we're going to see this big change because adversaries have the opportunity to use AI to go after targets they haven't previously been able to go after at scale. And also, you know, technologies like yours, you know, getting out there and getting a better understanding of everything that's being put together before it's put together, you know, and being able to be more proactive. Hopefully if we have enough of that, have enough of, you know, companies like yours and the technologies you're producing, that we won't have people that have to go out and think they have to do it all on their own. They'll at least be going after the right targets that have been vetted by people with the right technical backgrounds instead of just hunting and fishing and taking their shots at,, you know, whatever random architecture is getting thrown up and doing it in perhaps haphazard ways. Uh, it'll be interesting to see what the next few years bring us. I think you mentioned it, chaos. I worry about that, but I think that could be the accurate term for what we're about to see.

Yeah, I think as well, like, you're playing at attribution is a dangerous game. You know, you, you really rarely know exactly what you're looking at. So it's, it's one thing you have to be extremely careful of and putting that hand into the hands of individual companies having a go, you know, that can go very wrong for sure. Undoubtedly. Yeah.

I think people are too quick to go, well, it, it, the IP's from this area, so it's, they're involved. No, it, it's a good chance somebody else is using it. Like the fact that there's so much shared infrastructure, you know, I, I think there are people, and I don't wanna insult anybody, obviously in the intelligence community, we, we do a lot of attribution stuff. So we, we are pretty diligent about it 'cause we're trained over the years and beaten up if we don't. You can't just say, well, here's the IP's in this country, or they're using this language. Or, you know, you have to have several things that come together. And even then, you're probably not gonna say with high confidence, you know, but it's, it's a combination of, of the language and the geo, you know, location and the, the, the targeting itself, you know, and the themes that are being used and the timing and, you know, and, and, and, right? There's a lot that has to go into it. And even then you're probably gonna get a, you know, likely possible, you know, nobody's gonna come out or shouldn't always come out and say, absolutely, this is so-and-so because You can impersonate almost anybody and spoof almost any technology.

And I think we, we know there's like countries that specialize in that, right? That's, that's their favorite thing, messing with people's heads, right? Pretend to be somebody else. So something you got to be very careful of.

Oh, absolutely. Nothing like starting a, a war between two other countries because you pretend to be one country attacking a country and you're just sitting on the side watching it unfold, right? Hasn't gotten to that point of a war necessarily, but certainly could, could become, you know, some sort of an international incident that has to be dealt with. And yeah, there's definitely countries that want to do that, create that chaos. For others because it's one less thing they have to worry about them while other people are occupied. So, all right, listen, we're, we're running towards the end here. I do want to, first of all, I wanna thank you. This has been really exciting and interesting to talk about. I think the technology you guys have is really cool. For anybody who wants to know more about Silent Push, certainly reach out to Ken Bagnall. You can check out www.silentpush.com. If you can't find any of that stuff, you forget all of it, just reach out to me. I'll get you in connection with them. Nice guy, good company, really cool platform. I like, I like what they're doing. As most people know, I don't do a lot of product plugs out here, but in this case, I think this talk had to be as much about your platform as anything else because it's very interesting. So moving on though to the closer question that everybody gets, you know this, you know, our guests do get some prep time at least now. The name of the show is "Unspoken Security." So with that in mind, tell me something you've never told anyone, something unspoken. And I know you kind of cheated and got ahead a little bit on this one, which means now you're stuck coming up with another one. You can't use the same one you used earlier in the show.

I can't use the same one?

No, no, it's your fault. You made that mistake. I was listening, I was like, "Oh good, I'm gonna get 2 outta Ken now." Can't you something you already told somebody? Not unspoken anymore.

I've been at marketing people, so prepare that one especially for you, you know.

Well, now you're on the spot. Tell me something else that's unspoken, something you haven't told people before. Be personal, be professional, whatever it might be.

Yeah, okay. Yeah, so I guess we should talk about something unspoken I'd never tell anybody. Is that, you know, one of my bottom of the barrel things is I will watch Naked and Afraid. Uh, if you've ever seen it.

I have seen it.

Absolutely. Absolutely. I've seen it.

So have you watched it all the seasons? Like from the beginning?

Yeah.

I like it all. Is this your guilty pleasure show?

Yeah. Starving in the jungle or whatever while getting bitten by mosquitoes.

Oh, I'm sorry. I just said It's, see, now this is, this is, this is what people tune in for. They want to hear this. So it's, it's funny you mention it. So I haven't seen the show in a few years. I did watch for the first few years and then they did like an extreme version or whatever. And then I think they had somebody.

Oh yeah. I won't watch it in a group if there's a group of people. It's not funny anymore.

Yeah. But I, I'm with you. I find it fascinating. It's an interesting way to study humans, right? And, and how humans interact. And yeah, I do find it to be sort of a fascinating examination in that regard. And yeah, I, I can feel their pain. Like there's no doubt about it. It's never comfortable. They're either in someplace that's super hot and full of mosquitoes or someplace very cold. Well, it hasn't been a lot of cold days, but some cold, right? Cold, rainy. It's fascinating to watch. I will tell you, since you've mentioned this as your guilty pleasure, I'll join you in this so you don't feel as bad about having experienced this. I at one point had proffered there should be an entire naked network because you've got Naked and Afraid. There was also a show called Naked Dating for a while, which was like a matchmaking show, but everybody was naked on an island or something like that. And I felt like you could add the naked news in there. I, I was actually doing programming in my head. I'm like, I think I can come up with that without pornography or anything. I mean, that'd be fine if you want there after hours, but I think you can come up with an entire network of nothing naked. The cooking shows would be a little dangerous. I think be careful if you're gonna do that. But, but if you're naked and afraid, they go and do all sorts of stuff without clothes on. So I felt like we had, we've missed an opportunity to have a naked network that's, you know, game shows and talk shows. And I'm not doing this naked, I promise, but I think we could have a whole naked network. So. You're definitely not the only one watching Naked and Afraid. Probably not the only one that's listening to this show who is as well. But it's interesting that that's your, that's your guilty pleasure show. It's a little Naked and Afraid. I kind of like it. Is it, is it, are you watching reruns too? Is this, is you watch it? I don't know why I'm gonna dig so far into this, but now I'm curious.

There's one reruns. I, I, I, I think there should be like a, you know, statistics published on things that happen on it as well. 'Cause like, It seems to follow like a number of patterns, right? Like there's a guy who say, yeah, I'm gonna, I'm gonna like shoot a pig or something, and you know, he ends up just lying there starving while his partner is like fishing with a net that she made out of her hair or something.

It's like bizarre, right? Exactly. No, that's a good point. It should be like a drinking game, right? You know, when the show starts, like, all right, you know, how long until somebody does act, right? Because you're, you're right, there's always somebody who thinks they're gonna Oh, this is gonna be easy. I've done this all before. I'm gonna lead the group. And that's normally the person who can't do something and just crumbles. And like I said, there's somebody you don't expect who all of a sudden it turns out, wow, she's, she's really crafty, or, or he's, you know, really creative. And this person's catching crabs, you know, who expected that to happen? But they're having crab, and then they gotta figure out how to make a fire so they can actually eat it, because crab you can't eat if you don't cook it, I promise.

And then you want arriving and refusing the fire starter, say, uh, we're gonna do this with sticks, right?

So stupid. So stupid. At this point, if you go on the show and you don't know like the 5 items, whatever, 3 items you're allowed, everybody should be looking basically the same ones. If you're in a group, you can compare notes, obviously. But yeah, people who turn down the Firestarter, I'm like, oh, you're so dumb. Like, no, no, I can make fire. Yeah, I'm sure you can, but you should take the instant fire. It's, it's worth it.

Yeah, I'm sure you can in Arizona or wherever you live, right?

But not in forest, right? Not the swamp that we put you in here where there's not a single piece of dry wood to be found. No, I'd say fire starter. The people with a pot is another one. I remember the first time somebody had a pot, I was like, that's a good idea. Yeah, it's pretty useful to have actually a small metal pot or something. And obviously a good knife. It seems like those are kind of the things you need to get through, right? So yeah, it's, it's, see, this is, this is more interesting than you might've imagined, right? The other one was interesting. I'm glad you told us about marketing. I think that's fascinating. But now everybody knows that your guilty pleasure is, is Naked and Afraid and nothing wrong with that. It's a good show. It's fun. It takes your mind off of work, I'm sure. I know you work a ton and it's nice to be able to get away and just unplug and watch people self-indulgent suffering, I guess. I don't even know what they get paid. I don't think it's— I don't even know what the prize is for that show, but it's not like a million or anything, I don't think. No, no. And some of them have gone home, you know, early from hospital trips and, and things like that. So, all right, well, I'll have to look and see. I haven't seen a few seasons now, so maybe I'll go check out what's, what's happened in Naked and Afraid over the last few years. Listen, We're up, we're up on time. I wanna thank you again, Ken, for coming on the show today. Is there any, any last words besides naked and afraid? Any last words you wanna leave the audience with before we jump out?

No, we have a free community app we provide to everybody for free. So you can check that out in Silent Push. We've got, so you can log in there and check out all our DNS history and scanning of the internet, et cetera, for absolutely nothing.

That's pretty cool. You guys have a, a browser extension, I think too, right?

We do. That's, that's for paid customers to get the Chrome browser extension.

Ah, okay. That's paid. Well, start with the free and then see how much you like it and talk to Ken, and I'm sure he'll make you a good deal if you wanna get the, the Chrome extension. So, all right, well listen, again, thanks for being here. For everybody who's listened and watched and stuck around to hear all about Naked and Afraid at the end of this episode, I appreciate you taking the time to be here. If you like the show, please, you know, make sure you, you give good reviews and you like it and you thumbs up in all the places and give the good comments. If you don't like the show, shut up. Now feel free to tell me and I'll see what I can do to make it better. The show is meant for, for the viewers and the listeners, not for me personally, but hopefully we're doing good things. So I appreciate you being here and looking forward to, to continuing to bring people like Ken and people smarter than myself on to talk about a lot of cool things. So having said all of that, I'm gonna go wrap it up for today. So this has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

Legends are made.